Privacy notice

Who we are

Northpoint Fitouts Ltd, company number 17451572, registered office Unit 2 Grange Road, Batley, WF17 6LL. We are the data controller for the personal data on this portal. [ICO registration number: ZA…]. You can reach us about your data at sales@northpointfitouts.co.uk or on 0113 871 5028. [Name the person responsible for data protection, if there is one.]

What this portal is

A private website where we share the drawings, quotations and documents for your project. You answer a quotation by email from its page, and we record your answer here. Only people we have invited can sign in, and each person sees only the sites they have been given access to.

What we hold about you

• Your name and work email address, which we use to invite you and to send you a sign-in code.
• Your phone number and your role at your organisation, where you or we have added them. You can change your role on the Account page.
• Which sites you can see, and when that access was given or taken away.
• What you do here: when you sign in, which projects and documents you open, what you download, the answers you give and whether you accept or decline a quotation. This is a log of activity on your project, kept so that both sides know what was sent and when.
• Technical details of each sign-in: the IP address and browser, and the town and country our hosting provider reads from the IP address, so that a sign-in from somewhere unexpected can be spotted. Every request for a sign-in code is recorded this way, with the address it was for, whether or not that address has an account.
• What you tell us: the answers you type, and anything you send through a request on the Account page.
• Project requests you send with Start a project: what you wrote, the drawings and photos you attached, and the name and number we should ring.
• Site photos. Anyone with access to a site can add, change or remove its photo, and everyone with access to that site sees it.

We do not ask you for a password. A six-digit code is sent to your email address each time you sign in. Once it has been used or has run out, we keep it with the record of that request, so we can help when signing in goes wrong.

Why we hold it, and the lawful basis

• To carry out the contract with your organisation, or to take the steps you ask for before one: sharing drawings and quotations, recording what was sent and what you answered. Contract.
• To keep the portal secure and to prove what was sent, to whom, and when. Legitimate interests — ours, and your organisation’s.
• To keep records the law requires us to keep, such as invoices and signed contracts. Legal obligation.

Where it goes

The portal runs on Cloudflare, which stores its database and files [in the European Union / in the United Kingdom — confirm the D1 and R2 locations]. Email is sent through [Cloudflare Email / the provider used]. If your enquiry came from our website, or your organisation is a customer, your name, organisation and contact details are also kept in Pipedrive, the sales system we use, [hosted in the EU]. [When contracts are signed electronically, the contract and your signature are held by DocuSign.] We do not sell personal data, and we do not use it for advertising.

How long we keep it

• Your account and its activity log: while your organisation is a customer, and for [six years] after the last project ends, because that is how long a building contract’s records are kept.
• Sign-in codes: ten minutes. Sign-in sessions: [30 days] of inactivity.
• The record of each request for a sign-in code (the address, the IP address, the town and country, the browser, what happened and a code that can no longer be used): 90 days.
• Website enquiries: [12 months] from the enquiry, or until they become a project.
• Invoices and signed contracts: [six years] from the end of the financial year, as the law requires.

[Confirm each period with your accountant or solicitor.]

What you can ask for

You can ask, at any time and free of charge, for a copy of the personal data we hold about you, for it to be corrected, for your account to be closed, or for your data to be deleted. The Account page has a button to ask for a copy, to close your account and to delete your data. For a correction, email us or ring us and we’ll put it right. We reply within one month. Where the law requires us to keep a record — an invoice, a signed contract, the record of what was sent to your organisation — we will tell you what stays and why.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Cookies

The portal sets one cookie, which keeps you signed in. It also keeps one note in your browser’s own storage, on your device: whether you paused the moving cards at the foot of your Home page. While a tab is open it keeps a few things for that tab only, and they go when you close it: the address you’re signing in with, a project request you haven’t sent yet, and the extras you’ve ticked on a quotation. None of these is used to track you across other websites, and there are no advertising or analytics cookies.

Changes to this notice

If this notice changes in a way that matters to you, we will say so on the portal and in the version and date at the top.